The Yahoo Hackers Weren't State-Sponsored, Security Firm Says

itwbennett writes from a report via CSO Online: After Yahoo raised eyebrows in the security community with its claim that state-sponsored hackers were responsible for the history-making breach, security firm InfoArmor now says it has evidence to the contrary. InfoArmor claims to have acquired some of the stolen information as part of its investigation into "Group E," a team of five professional hackers-for-hire believed to be from Eastern Europe. The database that InfoArmor has contains only "millions" of accounts, but it includes the users' login IDs, hashed passwords, mobile phone numbers and zip codes, said Andrew Komarov, InfoArmor's chief intelligence officer. Earlier this week, Chase Cunningham, director of cyber operations at security provider A10 Networks, called Yahoo's claim of state-sponsored actors a convenient, if trumped up, excuse: "If I want to cover my rear end and make it seem like I have plausible deniability, I would say 'nation-state actor' in a heartbeat." "Yahoo was compromised in 2014 by a group of professional blackhats who were hired to compromise customer databases from a variety of different targeted organizations," Scottsdale, Arizona-based InfoArmor said Wednesday in a report. "The Yahoo data leak as well as the other notable exposures, opens the door to significant opportunities for cyber-espionage and targeted attacks to occur."

Pretty Bold-Faced Lie

[speedplane]

If it's true that Yahoo had no evidence to suggest a state sponsored attack, then Marissa Meyers should issue an official apology. They are inserting themselves in geopolitics purely for their own financial gain. Sickening.

Re:

[freeze128]

When Yahoo announced that they suspected they were hacked by "state-sponsored actors", my first question was "Well, how do they know?".

They don't seem to know who did it, but they already know that the hackers were state sponsored? That seems really fishy.

Re:

[speedplane]

They don't seem to know who did it, but they already know that the hackers were state sponsored? That seems really fishy.

It definitely seemed fishy. But I gave them the benefit of the doubt simply because it is a very serious allegation, one that a sophisticated company would not throw around too quickly. There should be some form of punishment (monetary, public shaming) if it turns out to be baseless.

Re:

[Big Hairy Ian]

Marissa Meyers should issue an official apology.

Good luck with that she's probably already got a bullet point on her CV (Resume for those across the pond) about how she lied about that

Re:

[nehumanuscrede]

I don't think it's for financial gain. Rather an attempt to gain sympathy or to hide their incompetence.

In the mass mindset, even if you secured your networks but were attacked by a " State " actor, then somehow it isn't your fault :|

However, if / when it comes out that you just didn't bother to keep up to date with common security practices and all that personal data gets taken, then your company tends to look bad.

So, just about everyone and their brother is going to claim a " State Sponsored " attack in

Re:

[speedplane]

I don't think it's for financial gain. Rather an attempt to gain sympathy or to hide their incompetence.

It's a corporation. Everything they do is for financial gain.

No Bear code?

[AHuxley]

So no trace of the smart Bear, skilled Bear, deceptive Bear or deep network Bear code?
Give the contractors time, later some ip rage, code fragment or just a timezone will be found showing Bear related entry and vast undetected plain text data flows.
Is work day timezone data flows to some distant nation not proof? Their gov works 9 to 5 so any data moved within their timezone at that time is proof enough....
National ip range logs at anytime over the months? Just one national ip needs to be found?

Re:

[ewhac]

On Linux: Add the non-free section to your Debian repository, then run:

apt-get install flashplugin-nonfree

Now you never have to visit Adobe's broken Web site again.

Re:

[AHuxley]

Insiders, political active staff, cults, less skilled governments, friendly govs with their own national interests, ex staff, former staff, mil staff, contractors, groups offering corporate espionage will now know to litter any server with well understood code, enter at a set time and have a distant staging server with an expected nations ip range.
The US tech media publishes talking points about easy to find code fragments, time zone, logs, ip range in a nice media release and stops investigating...

How would they know?

[ron_ivi]

Considering dozens of Intel agencies buy from black-hat groups ---- and they're good at buying stuff under pseudonyms ---- how would anyone know if they were state sponsored or not?

Re:

[bloodhawk]

The only way you would know is if the state sponsoring them actually came clean and told you. I would seriously doubt even the hackers themselves would know who they are working for.

Only one group

[Anonymous Coward]

Who says there is only one group. Quite possible multiple separate groups could have been in the network at the same time!

Re: This is crazy

[ytene]

Very simple. Suppose you have a job in the US government and a foreign state wants access to your government data. They can't achieve a direct assault, because government security is too strong. So they pick a weak target - a user. They figure many govt employees use yahoo ang may reuse passwords. So they crack yahoo, grab the password file and brute-force it. Now they can use that password to access you professional accounts. For all we know, this could have been the pre-cursor to the OPM hack.

State-Sponsored Attack == OMG Don't Blame Us

[Anonymous Coward]

Of course. 'State-sponsored attacks' have been peddled by the media long enough as a huge doomsday thing that the corporate PR people have realized that everyone will give a pass to any poor company besieged by such a massive, unstoppable attacker. Couldn't have been helped, nosireee.

Of course state attackers *are* extremely powerful and dangerous -- but companies have already clued in that blaming them is a free pass from the public for shoddy security.

Dog ate my homework?

[erp_consultant]

This "State Sponsored Hackers" thing is now the new "Dog ate my homework" lie. I guess it's better than, you know, telling the truth. But I suppose if she ever had to testify over it then it would be a bunch of take the 5th and "I don't recall".